Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 22 hours ago
48,622 skills
- algorand-vulnerability-scannertrailofbits/skillsScans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).SecurityNo warnings★ 7.9K↓ —
- exploits-searchdavepoon/buildwithclaudeSearch for exploits across all vulnerabilities with filtering by ecosystem, severity, source, and EPSSSecurityNo warnings★ 3.7K↓ —
- coinpaprika-apidavepoon/buildwithclaudeAccess cryptocurrency market data from CoinPaprika: prices, tickers, OHLCV, exchanges, contract lookups for 12,000+ coins and 350+ exchanges. Free tier, no API key needed. Install MCP: add https://mcp.coinpaprika.com/sse as SSE server, or install plugin: /plugin marketplace add coinpaprika/claude-marketplaceEngineeringNo warnings★ 3.7K↓ —
- product-briefjeremylongshore/tons-of-skills-marketplaceStructured product brief and PRD creation assistant. Use when the user needs to create a product brief, PRD, or feature spec that defines what to build and why. Trigger with "product brief", "PRD", "spec", "feature doc", "write a brief", or "define this feature".WritingNo warnings★ 2.9K↓ —
- cosmos-vulnerability-scannertrailofbits/skillsScans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.SecurityNo warnings★ 7.9K↓ —
- abridge-cost-tuningjeremylongshore/tons-of-skills-marketplaceEvaluate Abridge adoption, workflow value, and avoidable operational friction without inventing prices or vendor billing meters. Use when reviewing an Abridge rollout or renewal. Trigger with "analyze Abridge value".ProductivityNo warnings★ 2.9K↓ —
- constant-time-analysistrailofbits/skillsDetects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.SecurityNo warnings★ 7.9K↓ —
- paid-ads-launchnowork-studio/notfair-pluginPlan and prepare a new paid-media campaign or cross-channel test before it can spend. Use when asked to create, launch, start, set up, or allocate budget to an advertising campaign on any supported platform.MarketingNo warnings★ 4.1K↓ —
- codex-history-ingestAr9av/obsidian-wikiIngest Codex CLI conversation/session history into Obsidian as distilled knowledge. Use for importing or mining ~/.codex sessions, rollout files, indexes, or transcript logs; use wiki-agent for targeted topic-only recall.EngineeringNo warnings★ 3.6K↓ —
- gsd:insert-phasedavepoon/buildwithclaudeInsert urgent work as decimal phase (e.g., 72.1) between existing phasesOtherNo warnings★ 3.7K↓ —
- kiro-spec-quickgotalab/cc-sddQuick spec generation with interactive or automatic modePlanningNo warnings★ 3.7K↓ —
- skill-my-accountZJU-REAL/Easel查询用户自己在 Easel 已登录的小红书、抖音、快手、知乎和视频号身份、粉丝、获赞、关注及作品列表。 当用户问“我登录了哪些号、我是谁、我的粉丝/获赞、我最近发了什么、我有哪些帖子”时，先用本 SKILL 查本地登录态，不要先向用户索要账号名或链接。 某条帖子的评论抓取与分析分别用 skill-xhs-comment-reply 和 skill-comment-insights。OtherNo warnings★ 4.3K↓ —
- performance-analyzeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "analyze influencer campaign performance", "compare influencers", or "find what content worked"; produces metric scorecards vs target and benchmark, platform/influencer/content rankings, engagement-quality and sentiment reads, conversion-attribution breakdowns, and ranked learnings. Not for dollar-level return math — use roi-calculator. 达人营销效果分析/投放复盘MarketingNo warnings★ 3K↓ —
- gsd:ui-phasedavepoon/buildwithclaudeGenerate UI design contract (UI-SPEC.md) for frontend phasesDesignNo warnings★ 3.7K↓ —
- cal-com-automationdavepoon/buildwithclaudeAutomate Cal.com tasks via Rube MCP (Composio): manage bookings, check availability, configure webhooks, and handle teams. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- aflpptrailofbits/skillsSets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns, persistent mode, corpus minimization, and crash triage. Use when scaling fuzzing across cores, fuzzing a mature C/C++ codebase, reading the afl-fuzz status screen, or moving on after libFuzzer has plateaued.OtherNo warnings★ 7.9K↓ —
- property-based-testingtrailofbits/skillsWrites, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a whole input domain instead of a hand-picked list of examples: encode/decode and serialize/deserialize pairs, parsers, canonicalizers and normalizers, validators, numeric and Decimal types, comparators and sort order, data structures, and smart-contract state invariants. Also use when adding cases to an existing @given, fast-check, or proptest suite, when judging whether existing property tests assert anything real, and when a generator has shrunk a counterexample and you need to tell a wrong property from a genuine bug. Not for coverage-guided binary fuzzing (libFuzzer, AFL), mutation-testing campaigns, static analysis, benchmarking, or end-to-end UI tests.TestingNo warnings★ 7.9K↓ —
- shopify-automationdavepoon/buildwithclaudeAutomate Shopify tasks via Rube MCP (Composio): products, orders, customers, inventory, collections. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- navigating-githubjeremylongshore/tons-of-skills-marketplaceFirst-time GitHub setup and interactive git learning. Walks users from zero to a working GitHub repo, then teaches git through 9 hands-on lessons on their actual project. Adapts language and depth to skill level — inferred from environment, not questionnaires. Two modes: Setup (guided onboarding) and Learn (progressive curriculum from commits to CI/CD). Use when the user asks to set up GitHub, learn git, or says "teach me github". Trigger with "set up my repo", "help me with github", "teach me github", "learn git", "what are branches", "teach me PRs", or "how do I use github".DevOpsNo warnings★ 2.9K↓ —
- vulnerability-triage-brocardstrailofbits/skillsThis skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.SecurityNo warnings★ 7.9K↓ —
- jev-socialdavepoon/buildwithclaudeRun browser-grounded social research without remote account mutations through Jev Social when a user wants posts, profiles, comments, video evidence, or a source-linked report from Instagram, TikTok, or LinkedIn and the local socai CLI reports support for that platform. Do not use for publishing, engagement actions, or general web research.BrowserNo warnings★ 3.7K↓ —
- doca-capsNVIDIA/skillsUse this skill when the user wants to invoke the read-only doca_caps CLI to ask what DOCA sees on this host — listing DOCA devices and PCIe addresses, listing representor devices, asking which DOCA libraries are available on the current OS, checking per-device per-library capabilities, scoping output to a specific PCIe address, or capturing a side-effect-free capability snapshot for debug or install smoke-test. Trigger even when the user does not explicitly mention "doca_caps" or "capabilities print tool" — typical implicit phrasings include "what does DOCA actually see on this box", "is my BlueField PF visible to DOCA", "is Flow available on my RHEL host", "enumerate VF representors for pf0", "doca_caps: command not found", or "empty output for RDMA, is the tool broken". Refuse and route elsewhere for DOCA installation (doca-setup owns it; never walk the steps), library-internal capability matrices (Flow pipe creation, RDMA verbs features), streaming telemetry / DTS, or modifying the shipped binary.TestingNo warnings★ 3.8K↓ —
- howbacknotprop/pstackUse for "how does X work", code walkthroughs before changing something, and placement / ownership / layering questions ("where should this live", "which package owns this", "is this the right layer"). Explains subsystem architecture, runtime flow, onboarding mental models. Use why for motivation.PlanningNo warnings★ 3.3K↓ —
- chart-visualizationZJU-REAL/Easel将数据可视化为图表。当用户需要生成柱状图、折线图、饼图、散点图、雷达图、桑基图、思维导图、流程图等图表时调用此技能，通过 curl 工具调用 AntV API 生成图表图片。产出静态图片 URL（25+ 类型）；要本地渲染的信息图/GIF 动画图表用 infographic，要 CSV/JSON→整页报告用 data-reportDataNo warnings★ 4.3K↓ —
cold-outbound-sequencer
aaron-he-zhu/aaron-marketing-skills
DesignUpdated yesterday
From the author
Use when the user asks to "build a B2B cold-outbound sequence", "design reply-triage branching", "plan a domain warmup / sending throttle", or "make my outbound CAN-SPAM / opt-in compliant"; produces a multi-step outbound sequence with reply-triage branches (positive / objection / referral / not-now / opt-out), a warmup + send-throttle ramp schedule, jurisdiction opt-in/CAN-SPAM guardrails (guidance, not legal advice), and a SEND S-dimension read. Not for B2C lifecycle flows — use email-sequence-designer; not for the consent record — use consent-registry; not for computing EQS — use email-quality-auditor. B2B冷启动外联序列/回复分流/域名预热
Install
npx skills add aaron-he-zhu/aaron-marketing-skills --skill cold-outbound-sequencer -a claude-code
Installs to .claude/skills/cold-outbound-sequencer/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance82
Maintenance100
Licence100
Adoption55
Files (1)
- SKILL.md